Shands notifies 12,500 patients that data at risk

Tuesday

Mar 2, 2010 at 12:01 AM

Shands HealthCare has notified about 12,500 patients that a laptop containing their medical information was stolen in January.

By Nathan CrabbeStaff writer

Shands HealthCare has notified about 12,500 patients that a laptop containing their medical information was stolen in January.The unencrypted laptop contained information about patients referred over the past three years to the Shands at the University of Florida gastroenterology clinical services department.The information includes names, addresses, medical record numbers and medical procedure codes of the patients, as well as the Social Security numbers of about 650 people.There is no evidence that any of the information has been used for fraudulent purposes, according to Shands.A Shands employee who deals with the gastroenterology clinic's patient referral database downloaded the information under the belief that the laptop was encrypted, said Shands spokeswoman Kim Rose. The hospital-owned laptop was reported stolen Jan. 27 as part of a burglary of the employee's northwest Gainesville home.Last week, Shands confirmed to The Sun that a breach occurred but declined to provide details until notifications were sent to affected individuals over the weekend. Rose attributed the month-long lag time between the burglary and announcement of details to the time it took to follow legally required notification procedures."We want to make sure that we follow all the policies and procedures," she said.Since the incident, she said, Shands' human resources department has worked to "discipline and re-educate" the employee. Officials have since launched a system-wide encryption initiative to better safeguard protected health information stored on electronic devices, she said.Anyone affected by the breach is eligible for 12 months of free credit monitoring and can call a toll-free support center at 877-740-6995 for more information, according to Shands.Privacy breaches at Shands and UF, which deal with large amounts of personal information, occur on a regular basis. In 2008, a hacker accessed a computer server with the records of more than 300,000 UF College of Dentistry patients. That same year, an assistant professor of plastic surgery at the UF College of Medicine's Jacksonville campus resigned over the release of patient photos and their information on a personal computer.

More recently, reported privacy breaches have been on a much smaller scale. UF's Privacy Office sent out notifications for at least 13 breaches since August, most of which involved the personal information of a single individual.One breach involved a patient's medical record falling off a cart when being moved to Shands from a clinic. Another involved the medical records of one child being accidentally faxed to the parents of another child. Another included a patient's medical record being sent to the wrong person.Rose said the stolen laptop will serve to re-emphasize Shands' privacy policies."We always work to educate employees on our privacy policies ... This has given us another reminder," she said.Contact Nathan Crabbe at 338-3176 or nathan.crabbe@gvillesun.com. Follow him on Twitter at twitter.com/nathancrabbe.